Subject: Re: [Dots] Target-Attack-type expansion: more discussion

From: "Konda, Tirumaleswar Reddy" <[email-masked]>
Date: Mon, 1 Apr 2019 13:41:46 +0000

https://tools.ietf.org/html/draft-doron-dots-telemetry-00#section-3.1.3 discusses attack details and we need to figure out the right format to convey the attack details.

-Tiru

From: Dots <[email-masked]> On Behalf Of ???
Sent: Friday, March 29, 2019 4:45 PM
To: dots <[email-masked]>
Subject: [Dots] Target-Attack-type expansion: more discussion

CAUTION: External email. Do not click links or open attachments unless you recognize the sender and know the content is safe.

________________________________

Hi everyone,

Due to time constraints during my presentation, we hadn't make much more discuss yesterday,

I'd like to continue discussion of these topics in the mail if you have any questions or comments about this draft.

Thanks.

MeiLing Chen

--------------------------------------------------------------------------------------

Research institute of China mobile communications co. LTD

Institute of safety technology

Email address: [email-masked]<mailto:[email-masked]>

Phone: 13810149515

Address: no. 32, xuanwumen west street, xicheng district, Beijing (mobile innovation building)

---

From: Töma Gavrichenkov <[email-masked]>
Date: Mon, 1 Apr 2019 19:13:01 +0200

Peace,

On Fri, Mar 29, 2019 at 12:15 PM 陈美玲 <[email-masked]> wrote:
> I'd like to continue discussion of these topics in the mail

For clarification, the quotations below that line are from the draft
[1], not from the mailing list thread.

> Therefore, it is necessary to unify the attack definition,
> form a standard attack definition

I do not anticipate that happening in the foreseeable future. Mainly,
because of the differences between traffic classifying and filtering
engines. Also, because the state of scientific research on the problem
space is quite poor.

> we give out a complete format for DDoS attacks as below

>From the text and also from the slides [2] it is not clear what
exactly you list under "protocol level".
It appears like something very close to the OSI layering, however,

a) in this case the proper word would be "layer", not "level",
b) the attribution seems quite arbitrary.

E.g. ICMP flood is coupled with "Network_Layer" while it could also
affect the data link layer if e.g. there's no "no arp packet-priority
enable" on an interface in a Cisco switched network.
The same with memcached reflection which could cause an effect on the
layer 2 through 4 performance of a network (and I'd even go as far as
to say that L4 being affected is the least likely case).

***

All in all, as I tried to point out during the session, I've
personally seen a similar problem of conversion between different item
classification methods being solved before in 3GPP world, where e.g.
HP OpenView and Huawei M2000/J2000 had almost entirely different
concepts of event type, status, and severity, yet communicated just
fine through software-defined mapping tables provided by the
respective vendors. Sometimes, it's best to follow that path, and a
good thing is: you don't need a years-long IETF process for that to go
live.

References:
[1]: https://tools.ietf.org/html/draft-meiling-dots-attack-type-expansion-00
[2]: https://datatracker.ietf.org/meeting/104/materials/slides-104-dots-attack-bandwidth-and-attack-type-expansion-01

--
Töma

---

From: "Konda, Tirumaleswar Reddy" <[email-masked]>
Date: Thu, 4 Apr 2019 10:56:49 +0000

Agree with your response. If the attack type is described in some representation (e.g. text description) the WG decides, Natural Language Processing (e.g. word embedding) can be used to map the attack description to an attack type. It solves two problems (1) Avoids the need to create mapping tables manually (2) Avoid the need to standardize attack types which keep evolving.  

Cheers,
-Tiru

> -----Original Message-----
> From: Dots <[email-masked]> On Behalf Of Töma Gavrichenkov
> Sent: Monday, April 1, 2019 10:43 PM
> To: 陈美玲 <[email-masked]>
> Cc: dots <[email-masked]>
> Subject: Re: [Dots] Target-Attack-type expansion: more discussion
> 
> 
> 
> Peace,
> 
> For clarification, the quotations below that line are from the draft [1], not from
> the mailing list thread.
> 
> 
> > Therefore, it is necessary to unify the attack definition, form a
> > standard attack definition
> 
> I do not anticipate that happening in the foreseeable future. Mainly, because of
> the differences between traffic classifying and filtering engines. Also, because
> the state of scientific research on the problem space is quite poor.
> 
> E.g. ICMP flood is coupled with "Network_Layer" while it could also affect the
> data link layer if e.g. there's no "no arp packet-priority enable" on an interface
> in a Cisco switched network.
> The same with memcached reflection which could cause an effect on the layer
> 2 through 4 performance of a network (and I'd even go as far as to say that L4
> being affected is the least likely case).
> 
> ***
> 
> All in all, as I tried to point out during the session, I've personally seen a similar
> problem of conversion between different item classification methods being
> solved before in 3GPP world, where e.g.
> HP OpenView and Huawei M2000/J2000 had almost entirely different concepts
> of event type, status, and severity, yet communicated just fine through
> software-defined mapping tables provided by the respective vendors.
> Sometimes, it's best to follow that path, and a good thing is: you don't need a
> years-long IETF process for that to go live.
> 
> References:
> _______________________________________________
> Dots mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dots